tfMITRE ATT&CK sub-technique

Authentication Package T1547.002

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.1
Created: 24 January 2020
Last modified: 24 October 2025

Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Authentication Package MITRE reference T1547.002

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

FlameS0143 ↗

Can use Windows Authentication Packages for persistence.1

created 2017-05-31MALWARE

All 1 software entries for this technique

Offense vs defense T1547.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2022 Q4

Authentication Package detection strategy DET0207

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect LSA Authentication Package Persistence via Registry and LSASS DLL Load

Enterprise

1 platform

AN0583 · Windows

Registry modification of the LSA Authentication Packages key followed by LSASS loading a non-standard or unsigned DLL. This includes unusual write access to HKLM\SYSTEM\CurrentControlSet\Control\Lsa, especially during non-installation timeframes. Correlated with lsass.exe loading DLLs not present in baseline or lacking valid signatures.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time between registry write and DLL load; tune based on reboot cycles or scheduled maintenance
ImageSignatureStatus	Allow listing of known signed LSASS-authenticated DLLs versus unknown/untrusted ones
RegistryPathScope	Allow tuning for subkeys beyond just `Authentication Packages` (e.g., `Security Packages`, `Notification Packages`)
UserContext	Correlate user responsible for registry edit; tune for expected administrative/service accounts
ParentProcess	Validate process lineage for registry modification; expected tools like `reg.exe` or `powershell.exe`

Privileged Process IntegrityM1025

Windows 8.1, Windows Server 2012 R2, and later versions, may make LSA run as a Protected Process Light (PPL) by setting the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL, which requires all DLLs loaded by LSA to be signed by Microsoft.

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Authentication Package	windows	PowerShell	Required	—	Yes
Establishes persistence using a custom authentication package for the Local Security Authority (LSA). After a reboot, Notepad.exe will be executed as child process of lsass.exe. Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.002/package Related blog Attack command Copy-Item "$PathToAtomicsFolder\T1547.002\bin\package.dll" C:\Windows\System32\ reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0\0package.dll" /f Cleanup command reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0" /f rm -force C:\windows\system32\package.dll GUIDf59358c3-6ff9-45e9-a985-4b53a9849a14

Tests from Atomic Red Team (MIT licence) · technique definition

Authentication Package detections T1547.002

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs